Merge "msm: camera: reqmgr: reader writer locks to avoid memory faults" into camera-kernel.lnx.4.0

drivers/cam_core/cam_subdev.c

@@ -55,8 +55,10 @@ static long cam_subdev_ioctl(struct v4l2_subdev *sd, unsigned int cmd,
 
 	switch (cmd) {
 	case VIDIOC_CAM_CONTROL:
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
 		rc = cam_node_handle_ioctl(node,
 			(struct cam_control *) arg);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
 		break;
 	case CAM_SD_SHUTDOWN:
 		if (!cam_req_mgr_is_shutdown()) {

drivers/cam_fd/cam_fd_dev.c

@@ -44,8 +44,11 @@ static int cam_fd_dev_open(struct v4l2_subdev *sd,
 {
 	struct cam_fd_dev *fd_dev = &g_fd_dev;
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
 	if (!fd_dev->probe_done) {
 		CAM_ERR(CAM_FD, "FD Dev not initialized, fd_dev=%pK", fd_dev);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
 		return -ENODEV;
 	}
 
@@ -54,6 +57,8 @@ static int cam_fd_dev_open(struct v4l2_subdev *sd,
 	CAM_DBG(CAM_FD, "FD Subdev open count %d", fd_dev->open_cnt);
 	mutex_unlock(&fd_dev->lock);
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
 	return 0;
 }
 

drivers/cam_icp/cam_icp_subdev.c

@@ -20,7 +20,6 @@
 #include <media/cam_req_mgr.h>
 #include <media/cam_defs.h>
 #include <media/cam_icp.h>
-#include "cam_mem_mgr.h"
 #include "cam_req_mgr_dev.h"
 #include "cam_subdev.h"
 #include "cam_node.h"
@@ -74,6 +73,8 @@ static int cam_icp_subdev_open(struct v4l2_subdev *sd,
 	struct cam_node *node = v4l2_get_subdevdata(sd);
 	int rc = 0;
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
 	mutex_lock(&g_icp_dev.icp_lock);
 	if (g_icp_dev.open_cnt >= 1) {
 		CAM_ERR(CAM_ICP, "ICP subdev is already opened");
@@ -87,23 +88,16 @@ static int cam_icp_subdev_open(struct v4l2_subdev *sd,
 		goto end;
 	}
 
-
-	rc = cam_mem_mgr_init();
-	if (rc) {
-		CAM_ERR(CAM_CRM, "mem mgr init failed");
-		goto end;
-	}
-
 	hw_mgr_intf = &node->hw_mgr_intf;
 	rc = hw_mgr_intf->hw_open(hw_mgr_intf->hw_mgr_priv, NULL);
 	if (rc < 0) {
 		CAM_ERR(CAM_ICP, "FW download failed");
-		cam_mem_mgr_deinit();
 		goto end;
 	}
 	g_icp_dev.open_cnt++;
 end:
 	mutex_unlock(&g_icp_dev.icp_lock);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
 	return rc;
 }
 
@@ -139,7 +133,6 @@ int cam_icp_subdev_close_internal(struct v4l2_subdev *sd,
 		goto end;
 	}
 
-	cam_mem_mgr_deinit();
 end:
 	mutex_unlock(&g_icp_dev.icp_lock);
 	return rc;

drivers/cam_isp/cam_isp_dev.c

@@ -64,10 +64,14 @@ static const struct of_device_id cam_isp_dt_match[] = {
 static int cam_isp_subdev_open(struct v4l2_subdev *sd,
 	struct v4l2_subdev_fh *fh)
 {
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
 	mutex_lock(&g_isp_dev.isp_mutex);
 	g_isp_dev.open_cnt++;
 	mutex_unlock(&g_isp_dev.isp_mutex);
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
 	return 0;
 }
 

drivers/cam_jpeg/cam_jpeg_dev.c

@@ -48,11 +48,14 @@ static const struct of_device_id cam_jpeg_dt_match[] = {
 static int cam_jpeg_subdev_open(struct v4l2_subdev *sd,
 	struct v4l2_subdev_fh *fh)
 {
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
 
 	mutex_lock(&g_jpeg_dev.jpeg_mutex);
 	g_jpeg_dev.open_cnt++;
 	mutex_unlock(&g_jpeg_dev.jpeg_mutex);
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
 	return 0;
 }
 

drivers/cam_lrme/cam_lrme_dev.c

@@ -59,9 +59,12 @@ static int cam_lrme_dev_open(struct v4l2_subdev *sd,
 {
 	struct cam_lrme_dev *lrme_dev = g_lrme_dev;
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
 	if (!lrme_dev) {
 		CAM_ERR(CAM_LRME,
 			"LRME Dev not initialized, dev=%pK", lrme_dev);
+		cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
 		return -ENODEV;
 	}
 
@@ -69,6 +72,8 @@ static int cam_lrme_dev_open(struct v4l2_subdev *sd,
 	lrme_dev->open_cnt++;
 	mutex_unlock(&lrme_dev->lock);
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
+
 	return 0;
 }
 

drivers/cam_ope/cam_ope_subdev.c

@@ -69,6 +69,8 @@ static int cam_ope_subdev_open(struct v4l2_subdev *sd,
 	struct cam_node *node = v4l2_get_subdevdata(sd);
 	int rc = 0;
 
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK);
+
 	mutex_lock(&g_ope_dev.ope_lock);
 	if (g_ope_dev.open_cnt >= 1) {
 		CAM_ERR(CAM_OPE, "OPE subdev is already opened");
@@ -92,6 +94,7 @@ static int cam_ope_subdev_open(struct v4l2_subdev *sd,
 	CAM_DBG(CAM_OPE, "OPE HW open success: %d", rc);
 end:
 	mutex_unlock(&g_ope_dev.ope_lock);
+	cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK);
 	return rc;
 }
 

drivers/cam_req_mgr/cam_mem_mgr.c

@@ -19,11 +19,8 @@
 #include "cam_trace.h"
 #include "cam_common_util.h"
 
-static struct cam_mem_table tbl = {
-	.m_lock = __MUTEX_INITIALIZER(tbl.m_lock),
-};
-
-static atomic_t cam_mem_mgr_refcnt = ATOMIC_INIT(0);
+static struct cam_mem_table tbl;
+static atomic_t cam_mem_mgr_state = ATOMIC_INIT(CAM_MEM_MGR_UNINITIALIZED);
 
 static void cam_mem_mgr_print_tbl(void)
 {
@@ -167,16 +164,6 @@ int cam_mem_mgr_init(void)
 	int i;
 	int bitmap_size;
 
-	mutex_lock(&tbl.m_lock);
-
-	if (atomic_inc_return(&cam_mem_mgr_refcnt) > 1) {
-		CAM_DBG(CAM_MEM,
-			"Mem mgr refcnt: %d",
-			atomic_read(&cam_mem_mgr_refcnt));
-		mutex_unlock(&tbl.m_lock);
-		return 0;
-	}
-
 	memset(tbl.bufq, 0, sizeof(tbl.bufq));
 
 	if (cam_smmu_need_force_alloc_cached(&tbl.force_cache_allocs)) {
@@ -186,13 +173,8 @@ int cam_mem_mgr_init(void)
 
 	bitmap_size = BITS_TO_LONGS(CAM_MEM_BUFQ_MAX) * sizeof(long);
 	tbl.bitmap = kzalloc(bitmap_size, GFP_KERNEL);
-	if (!tbl.bitmap) {
-		atomic_dec(&cam_mem_mgr_refcnt);
-		CAM_DBG(CAM_MEM, "Mem mgr refcnt: %d",
-			atomic_read(&cam_mem_mgr_refcnt));
-		mutex_unlock(&tbl.m_lock);
+	if (!tbl.bitmap)
 		return -ENOMEM;
-	}
 
 	tbl.bits = bitmap_size * BITS_PER_BYTE;
 	bitmap_zero(tbl.bitmap, tbl.bits);
@@ -203,8 +185,9 @@ int cam_mem_mgr_init(void)
 		tbl.bufq[i].fd = -1;
 		tbl.bufq[i].buf_handle = -1;
 	}
+	mutex_init(&tbl.m_lock);
 
-	mutex_unlock(&tbl.m_lock);
+	atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_INITIALIZED);
 
 	cam_mem_mgr_create_debug_fs();
 
@@ -251,7 +234,7 @@ int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
 
 	*len_ptr = 0;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -302,7 +285,12 @@ int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len)
 {
 	int idx;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
+		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
+		return -EINVAL;
+	}
+
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -345,7 +333,7 @@ int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd)
 	uint32_t cache_dir;
 	unsigned long dmabuf_flag = 0;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -671,7 +659,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd)
 	uintptr_t kvaddr = 0;
 	size_t klen;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -823,7 +811,7 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd *cmd)
 	size_t len = 0;
 	bool is_internal = false;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -1010,6 +998,7 @@ static int cam_mem_mgr_cleanup_table(void)
 {
 	int i;
 
+	mutex_lock(&tbl.m_lock);
 	for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
 		if (!tbl.bufq[i].active) {
 			CAM_DBG(CAM_MEM,
@@ -1045,27 +1034,23 @@ static int cam_mem_mgr_cleanup_table(void)
 	bitmap_zero(tbl.bitmap, tbl.bits);
 	/* We need to reserve slot 0 because 0 is invalid */
 	set_bit(0, tbl.bitmap);
+	mutex_unlock(&tbl.m_lock);
 
 	return 0;
 }
 
 void cam_mem_mgr_deinit(void)
 {
-	mutex_lock(&tbl.m_lock);
-	if (!atomic_dec_and_test(&cam_mem_mgr_refcnt)) {
-		CAM_DBG(CAM_MEM, "Mem mgr refcnt: %d",
-			atomic_read(&cam_mem_mgr_refcnt));
-		mutex_unlock(&tbl.m_lock);
-		return;
-	}
-
+	atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_UNINITIALIZED);
 	cam_mem_mgr_cleanup_table();
 	debugfs_remove_recursive(tbl.dentry);
+	mutex_lock(&tbl.m_lock);
 	bitmap_zero(tbl.bitmap, tbl.bits);
 	kfree(tbl.bitmap);
 	tbl.bitmap = NULL;
 	tbl.dbg_buf_idx = -1;
 	mutex_unlock(&tbl.m_lock);
+	mutex_destroy(&tbl.m_lock);
 }
 
 static int cam_mem_util_unmap(int32_t idx,
@@ -1163,7 +1148,7 @@ int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd)
 	int idx;
 	int rc;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -1216,7 +1201,7 @@ int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp,
 
 	enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -1342,7 +1327,7 @@ int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp)
 	int32_t idx;
 	int rc;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -1395,7 +1380,7 @@ int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp,
 	int32_t smmu_hdl = 0;
 	int32_t num_hdl = 0;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}
@@ -1490,7 +1475,7 @@ int cam_mem_mgr_free_memory_region(struct cam_mem_mgr_memory_desc *inp)
 	int rc;
 	int32_t smmu_hdl;
 
-	if (!atomic_read(&cam_mem_mgr_refcnt)) {
+	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
 		return -EINVAL;
 	}

drivers/cam_req_mgr/cam_mem_mgr.h

@@ -11,6 +11,12 @@
 #include <media/cam_req_mgr.h>
 #include "cam_mem_mgr_api.h"
 
+/* Enum for possible mem mgr states */
+enum cam_mem_mgr_state {
+	CAM_MEM_MGR_UNINITIALIZED,
+	CAM_MEM_MGR_INITIALIZED,
+};
+
 /*Enum for possible SMMU operations */
 enum cam_smmu_mapping_client {
 	CAM_SMMU_MAPPING_USER,

drivers/cam_req_mgr/cam_req_mgr_dev.c

@@ -8,6 +8,7 @@
 #include <linux/platform_device.h>
 #include <linux/highmem.h>
 #include <linux/types.h>
+#include <linux/rwsem.h>
 
 #include <mm/slab.h>
 
@@ -35,6 +36,8 @@ static struct cam_req_mgr_device g_dev;
 struct kmem_cache *g_cam_req_mgr_timer_cachep;
 static struct list_head cam_req_mgr_ordered_sd_list;
 
+DECLARE_RWSEM(rwsem_lock);
+
 static struct device_attribute camera_debug_sysfs_attr =
 	__ATTR(debug_node, 0600, NULL, cam_debug_sysfs_node_store);
 
@@ -103,10 +106,29 @@ static void cam_v4l2_device_cleanup(void)
 	g_dev.v4l2_dev = NULL;
 }
 
+
+void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock)
+{
+	if (lock == CAM_SUBDEV_LOCK)
+		down_read(&rwsem_lock);
+	else if (lock == CAM_SUBDEV_UNLOCK)
+		up_read(&rwsem_lock);
+}
+
+static void cam_req_mgr_rwsem_write_op(enum cam_subdev_rwsem lock)
+{
+	if (lock == CAM_SUBDEV_LOCK)
+		down_write(&rwsem_lock);
+	else if (lock == CAM_SUBDEV_UNLOCK)
+		up_write(&rwsem_lock);
+}
+
 static int cam_req_mgr_open(struct file *filep)
 {
 	int rc;
 
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
+
 	mutex_lock(&g_dev.cam_lock);
 	if (g_dev.open_cnt >= 1) {
 		rc = -EALREADY;
@@ -133,12 +155,14 @@ static int cam_req_mgr_open(struct file *filep)
 	}
 
 	mutex_unlock(&g_dev.cam_lock);
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
 	return rc;
 
 mem_mgr_init_fail:
 	v4l2_fh_release(filep);
 end:
 	mutex_unlock(&g_dev.cam_lock);
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
 	return rc;
 }
 
@@ -168,10 +192,14 @@ static int cam_req_mgr_close(struct file *filep)
 	CAM_WARN(CAM_CRM,
 		"release invoked associated userspace process has died, open_cnt: %d",
 		g_dev.open_cnt);
+
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
+
 	mutex_lock(&g_dev.cam_lock);
 
 	if (g_dev.open_cnt <= 0) {
 		mutex_unlock(&g_dev.cam_lock);
+		cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
 		return -EINVAL;
 	}
 
@@ -203,6 +231,8 @@ static int cam_req_mgr_close(struct file *filep)
 	cam_mem_mgr_deinit();
 	mutex_unlock(&g_dev.cam_lock);
 
+	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
+
 	return 0;
 }
 

drivers/cam_req_mgr/cam_req_mgr_util.c

@@ -15,6 +15,7 @@
 #include "cam_req_mgr_util.h"
 #include "cam_debug_util.h"
 #include "cam_context.h"
+#include "cam_subdev.h"
 
 static struct cam_req_mgr_util_hdl_tbl *hdl_tbl;
 static DEFINE_SPINLOCK(hdl_tbl_lock);
@@ -163,6 +164,14 @@ int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data)
 	int idx;
 	int rand = 0;
 	int32_t handle;
+	bool crm_active;
+
+	crm_active = cam_req_mgr_is_open(CAM_CRM);
+	if (!crm_active) {
+		CAM_ERR(CAM_CRM, "CRM is not ACTIVE");
+		spin_unlock_bh(&hdl_tbl_lock);
+		return -EINVAL;
+	}
 
 	spin_lock_bh(&hdl_tbl_lock);
 	if (!hdl_tbl) {

drivers/cam_req_mgr/cam_subdev.h

@@ -28,6 +28,11 @@ enum cam_subdev_close_seq_priority {
 	CAM_SD_CLOSE_LOW_PRIORITY
 };
 
+enum cam_subdev_rwsem {
+	CAM_SUBDEV_LOCK = 1,
+	CAM_SUBDEV_UNLOCK,
+};
+
 /**
  * struct cam_subdev - describes a camera sub-device
  *
@@ -130,6 +135,15 @@ int cam_register_subdev(struct cam_subdev *sd);
  */
 int cam_unregister_subdev(struct cam_subdev *sd);
 
+/**
+ * cam_req_mgr_rwsem_read_op()
+ *
+ * @brief : API to acquire read semaphore lock to platform framework.
+ *
+ * @lock  : value indicates to lock or unlock the read lock
+ */
+void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock);
+
 /**
  * cam_req_mgr_is_open()
  *

drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c

@@ -859,6 +859,11 @@ int32_t cam_actuator_driver_cmd(struct cam_actuator_ctrl_t *a_ctrl,
 
 		actuator_acq_dev.device_handle =
 			cam_create_device_hdl(&bridge_params);
+		if (actuator_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_ACTUATOR, "Can not create device handle");
+			goto release_mutex;
+		}
 		a_ctrl->bridge_intf.device_hdl = actuator_acq_dev.device_handle;
 		a_ctrl->bridge_intf.session_hdl =
 			actuator_acq_dev.session_handle;

drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c

@@ -1182,6 +1182,12 @@ int32_t cam_csiphy_core_cfg(void *phy_dev,
 		index = csiphy_dev->acquire_count;
 		csiphy_acq_dev.device_handle =
 			cam_create_device_hdl(&bridge_params);
+		if (csiphy_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_CSIPHY, "Can not create device handle");
+			goto release_mutex;
+		}
+
 		csiphy_dev->csiphy_info[index].hdl_data.device_hdl =
 			csiphy_acq_dev.device_handle;
 		csiphy_dev->csiphy_info[index].hdl_data.session_hdl =

drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c

@@ -360,6 +360,10 @@ static int32_t cam_eeprom_get_dev_handle(struct cam_eeprom_ctrl_t *e_ctrl,
 
 	eeprom_acq_dev.device_handle =
 		cam_create_device_hdl(&bridge_params);
+	if (eeprom_acq_dev.device_handle <= 0) {
+		CAM_ERR(CAM_EEPROM, "Can not create device handle");
+		return -EFAULT;
+	}
 	e_ctrl->bridge_intf.device_hdl = eeprom_acq_dev.device_handle;
 	e_ctrl->bridge_intf.session_hdl = eeprom_acq_dev.session_handle;
 

drivers/cam_sensor_module/cam_flash/cam_flash_dev.c

@@ -68,6 +68,11 @@ static int32_t cam_flash_driver_cmd(struct cam_flash_ctrl *fctrl,
 
 		flash_acq_dev.device_handle =
 			cam_create_device_hdl(&bridge_params);
+		if (flash_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_FLASH, "Can not create device handle");
+			goto release_mutex;
+		}
 		fctrl->bridge_intf.device_hdl =
 			flash_acq_dev.device_handle;
 		fctrl->bridge_intf.session_hdl =

drivers/cam_sensor_module/cam_ois/cam_ois_core.c

@@ -86,6 +86,10 @@ static int cam_ois_get_dev_handle(struct cam_ois_ctrl_t *o_ctrl,
 
 	ois_acq_dev.device_handle =
 		cam_create_device_hdl(&bridge_params);
+	if (ois_acq_dev.device_handle <= 0) {
+		CAM_ERR(CAM_OIS, "Can not create device handle");
+		return -EFAULT;
+	}
 	o_ctrl->bridge_intf.device_hdl = ois_acq_dev.device_handle;
 	o_ctrl->bridge_intf.session_hdl = ois_acq_dev.session_handle;
 

drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c

@@ -839,6 +839,11 @@ int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl,
 
 		sensor_acq_dev.device_handle =
 			cam_create_device_hdl(&bridge_params);
+		if (sensor_acq_dev.device_handle <= 0) {
+			rc = -EFAULT;
+			CAM_ERR(CAM_SENSOR, "Can not create device handle");
+			goto release_mutex;
+		}
 		s_ctrl->bridge_intf.device_hdl = sensor_acq_dev.device_handle;
 		s_ctrl->bridge_intf.session_hdl = sensor_acq_dev.session_handle;